CVE-2026-48756 lxc CVE debrief

Who should care

Users of Incus system container and virtual machine manager, administrators with can_create_storage_volumes permission, and security teams responsible for vulnerability management and incident response should be aware of this issue. They should review the code, verify system exposure, and implement mitigations as needed.

Technical summary

An authenticated user with can_create_storage_volumes permission on any project can crash the incusd daemon by uploading a backup tarball whose volume_snapshots[*].expires_at field is absent. This is due to an unguarded *time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup in `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go`.

Defensive priority

Authenticated users with can_create_storage_volumes permission can crash the incusd daemon by uploading a malformed backup tarball.

Recommended defensive actions

• Verify and update Incus to version 7.1.0 or later
• Restrict access to can_create_storage_volumes permission
• Monitor for and block suspicious backup tarball uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The bug is an unguarded *time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. This occurs in `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go`. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. To verify, defenders should review the code for similar unguarded dereferences, check for backup tarballs with absent or malformed `expires_at` fields, and monitor for daemon crashes indicative of this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.